Re: [quicwg/base-drafts] Allow endpoints to generate traffic keys asynchronously (#3874)

[Kazuho Oku <[e-mail]>]

@kazuho commented on this pull request.



> @@ -518,14 +518,17 @@ or when Initial or Handshake keys are discarded. This ensures the PTO is always
 set based on the latest RTT information and for the last sent packet in the
 correct packet number space.
 
+When setting the PTO timer, the ApplicationData packet number space (Section
+4.1.1 of {{QUIC-TLS}}) MUST be ignored until the handshake completes. Not arming
+the PTO for ApplicationData prevents a client from retransmitting a 0-RTT packet
+on a PTO expiration before confirming that the server is able to decrypt 0-RTT

I think you are correct in pointing out the ACK case, though
* the argument to not send 0-RTT probes before learning if the peer is accepting 0-RTT still holds; that's the only signal available to the client when the server rejects 0-RTT
* technically the acceptance (or rejection) of 0-RTT data is transmitting in EncryptedExtensions, not ServerHello.

In b5e0c16 I've changed the text to point out that both endpoints are covered by the ACK case.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3874#discussion_r451557053